As computer networks continue to grow exponentially, a variety of malicious software schemes (also known as “malware”) have also emerged. These malware schemes include viruses, worms and other such mechanisms by which unauthorized third parties may attempt to compromise computer systems and/or networks. Computer worms, for example, scan for computers within a computer network that may be vulnerable to an attack. Despite efforts such as firewalls and/or security software, worms may nonetheless propagate onto various computers on a network and cause significant damage.
More specifically, worms typically propagate by probing various network locations to determine whether it can propagate itself into that network location. Thus, if it identifies a computer system that is vulnerable (e.g., not protected by a firewall), the worm may execute code on the computer system that enables the worm to propagate itself onto that device. The worm may then spread itself to other network locations within that computer system's local network as well as concurrently propagate itself onto other computers accessible by the first computer system.
Thus, for example, if a worm probes a network address and finds a security vulnerability within that location, it may copy itself to the second network location and execute the executable code again, which propagates the worm to the other network location. This may continue until host and networks are slowed down to a crawl by the large number of worms, each of which may be consuming a significant amount of processor and network resources.
One scheme to prevent the proliferation of worms on a network uses the concept of “tarpits.” If a network utilizes tarpits, a security system or security routine may be programmed to recognize all valid addresses and ports on the network and any attempts to access the unused network addresses and ports may be deemed to be unauthorized access attempts. The security system may be programmed to issue a “busy,” “wait,” or “retry” response, which essentially occupies the scanning capabilities of the worms. As a result, the worms' ability to spread becomes increasingly limited.